| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Thu, 23 May 2024 09:19:09 -0400
From: Peter Xu <peterx@...hat.com>
To: Mikhail Gavrilov <mikhail.v.gavrilov@...il.com>
Cc: David Hildenbrand <david@...hat.com>,
Pavel Tatashin <pasha.tatashin@...een.com>,
axelrasmussen@...gle.com, nadav.amit@...il.com,
Andrew Morton <akpm@...ux-foundation.org>,
Linux Memory Management List <linux-mm@...ck.org>,
Linux List Kernel Mailing <linux-kernel@...r.kernel.org>
Subject: Re: 6.10/bisected/regression - commit 8430557fc584 cause warning at
mm/page_table_check.c:198 __page_table_check_ptes_set+0x306
On Thu, May 23, 2024 at 11:34:37AM +0500, Mikhail Gavrilov wrote:
> On Wed, May 22, 2024 at 9:10 PM Peter Xu <peterx@...hat.com> wrote:
> >
> > ===8<===
> > From c10cde00b14d2d305390dd418a8a8855d3e6437f Mon Sep 17 00:00:00 2001
> > From: Peter Xu <peterx@...hat.com>
> > Date: Wed, 22 May 2024 12:04:33 -0400
> > Subject: [PATCH] drop RANDOM_ORVALUE bits
> >
> > Signed-off-by: Peter Xu <peterx@...hat.com>
> > ---
> > mm/debug_vm_pgtable.c | 30 ++++--------------------------
> > 1 file changed, 4 insertions(+), 26 deletions(-)
> >
> > diff --git a/mm/debug_vm_pgtable.c b/mm/debug_vm_pgtable.c
> > index f1c9a2c5abc0..b5d7be05063a 100644
> > --- a/mm/debug_vm_pgtable.c
> > +++ b/mm/debug_vm_pgtable.c
> > @@ -40,22 +40,7 @@
> > * Please refer Documentation/mm/arch_pgtable_helpers.rst for the semantics
> > * expectations that are being validated here. All future changes in here
> > * or the documentation need to be in sync.
> > - *
> > - * On s390 platform, the lower 4 bits are used to identify given page table
> > - * entry type. But these bits might affect the ability to clear entries with
> > - * pxx_clear() because of how dynamic page table folding works on s390. So
> > - * while loading up the entries do not change the lower 4 bits. It does not
> > - * have affect any other platform. Also avoid the 62nd bit on ppc64 that is
> > - * used to mark a pte entry.
> > */
> > -#define S390_SKIP_MASK GENMASK(3, 0)
> > -#if __BITS_PER_LONG == 64
> > -#define PPC64_SKIP_MASK GENMASK(62, 62)
> > -#else
> > -#define PPC64_SKIP_MASK 0x0
> > -#endif
> > -#define ARCH_SKIP_MASK (S390_SKIP_MASK | PPC64_SKIP_MASK)
> > -#define RANDOM_ORVALUE (GENMASK(BITS_PER_LONG - 1, 0) & ~ARCH_SKIP_MASK)
> > #define RANDOM_NZVALUE GENMASK(7, 0)
> >
> > struct pgtable_debug_args {
> > @@ -511,8 +496,7 @@ static void __init pud_clear_tests(struct pgtable_debug_args *args)
> > return;
> >
> > pr_debug("Validating PUD clear\n");
> > - pud = __pud(pud_val(pud) | RANDOM_ORVALUE);
> > - WRITE_ONCE(*args->pudp, pud);
> > + WARN_ON(pud_none(pud));
> > pud_clear(args->pudp);
> > pud = READ_ONCE(*args->pudp);
> > WARN_ON(!pud_none(pud));
> > @@ -548,8 +532,7 @@ static void __init p4d_clear_tests(struct pgtable_debug_args *args)
> > return;
> >
> > pr_debug("Validating P4D clear\n");
> > - p4d = __p4d(p4d_val(p4d) | RANDOM_ORVALUE);
> > - WRITE_ONCE(*args->p4dp, p4d);
> > + WARN_ON(p4d_none(p4d));
> > p4d_clear(args->p4dp);
> > p4d = READ_ONCE(*args->p4dp);
> > WARN_ON(!p4d_none(p4d));
> > @@ -582,8 +565,7 @@ static void __init pgd_clear_tests(struct pgtable_debug_args *args)
> > return;
> >
> > pr_debug("Validating PGD clear\n");
> > - pgd = __pgd(pgd_val(pgd) | RANDOM_ORVALUE);
> > - WRITE_ONCE(*args->pgdp, pgd);
> > + WARN_ON(pgd_none(pgd));
> > pgd_clear(args->pgdp);
> > pgd = READ_ONCE(*args->pgdp);
> > WARN_ON(!pgd_none(pgd));
> > @@ -634,9 +616,6 @@ static void __init pte_clear_tests(struct pgtable_debug_args *args)
> > if (WARN_ON(!args->ptep))
> > return;
> >
> > -#ifndef CONFIG_RISCV
> > - pte = __pte(pte_val(pte) | RANDOM_ORVALUE);
> > -#endif
> > set_pte_at(args->mm, args->vaddr, args->ptep, pte);
> > flush_dcache_page(page);
> > barrier();
> > @@ -650,8 +629,7 @@ static void __init pmd_clear_tests(struct pgtable_debug_args *args)
> > pmd_t pmd = READ_ONCE(*args->pmdp);
> >
> > pr_debug("Validating PMD clear\n");
> > - pmd = __pmd(pmd_val(pmd) | RANDOM_ORVALUE);
> > - WRITE_ONCE(*args->pmdp, pmd);
> > + WARN_ON(pmd_none(pmd));
> > pmd_clear(args->pmdp);
> > pmd = READ_ONCE(*args->pmdp);
> > WARN_ON(!pmd_none(pmd));
> > --
> > 2.45.0
> >
> > --
> > Peter Xu
> >
>
> Good news the patch works and the warning at mm/page_table_check.c:198
> __page_table_check_ptes_set+0x306 is gone.
> Tested-by: Mikhail Gavrilov <mikhail.v.gavrilov@...il.com>
Thanks.
>
> Bad news the testing terminated with an old annoying problem which
> appeared during the 6.9 release cycle [1] and looks like it has not
> been fixed yet.
> [24119.281379] BUG: Bad page state in process kcompactd0 pfn:3ae37e
> [24119.281387] page: refcount:0 mapcount:0 mapping:00000000d16c2d75
> index:0x272ea3200 pfn:0x3ae37e
> [24119.281390] aops:btree_aops ino:1
> [24119.281395] flags:
> 0x17ffffc000020c(referenced|uptodate|workingset|node=0|zone=2|lastcpupid=0x1fffff)
> [24119.281400] raw: 0017ffffc000020c dead000000000100 dead000000000122
> ffff888136ecd220
> [24119.281402] raw: 0000000272ea3200 0000000000000000 00000000ffffffff
> 0000000000000000
> [24119.281403] page dumped because: non-NULL mapping
> [24119.281405] Modules linked in: overlay tun crypto_user uinput
> snd_seq_dummy snd_hrtimer rfcomm nf_conntrack_netbios_ns
> nf_conntrack_broadcast nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib
> nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct
> nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set
> nf_tables qrtr uhid bnep sunrpc binfmt_misc amd_atl intel_rapl_msr
> intel_rapl_common mt76x2u mt76x2_common mt7921e mt7921_common
> mt76x02_usb mt76_usb mt792x_lib mt76x02_lib mt76_connac_lib vfat mt76
> fat mac80211 snd_hda_codec_hdmi snd_hda_intel edac_mce_amd
> snd_intel_dspcfg snd_intel_sdw_acpi snd_usb_audio uvcvideo
> snd_hda_codec kvm_amd btusb snd_usbmidi_lib uvc snd_hda_core snd_ump
> btrtl videobuf2_vmalloc btintel videobuf2_memops snd_rawmidi snd_hwdep
> videobuf2_v4l2 btbcm btmtk snd_seq videobuf2_common libarc4
> snd_seq_device kvm bluetooth ledtrig_netdev videodev snd_pcm cfg80211
> joydev asus_nb_wmi eeepc_wmi mc snd_timer asus_wmi sparse_keymap rapl
> apple_mfi_fastcharge snd wmi_bmof platform_profile
> [24119.281465] pcspkr igc k10temp soundcore i2c_piix4 rfkill
> gpio_amdpt gpio_generic loop nfnetlink zram amdgpu crct10dif_pclmul
> crc32_pclmul crc32c_intel amdxcp polyval_clmulni i2c_algo_bit
> polyval_generic drm_ttm_helper ttm nvme drm_exec ghash_clmulni_intel
> gpu_sched drm_suballoc_helper sha512_ssse3 drm_buddy nvme_core ccp
> sha256_ssse3 drm_display_helper sha1_ssse3 sp5100_tco video nvme_auth
> wmi hid_apple ip6_tables ip_tables fuse
> [24119.281496] CPU: 30 PID: 221 Comm: kcompactd0 Tainted: G W
> L 6.9.0-test-5f16eb0549ab-with-drop-RANDOM_ORVALUE-bits+ #34
> [24119.281498] Hardware name: ASUS System Product Name/ROG STRIX
> B650E-I GAMING WIFI, BIOS 2611 04/07/2024
> [24119.281500] Call Trace:
> [24119.281502] <TASK>
> [24119.281503] dump_stack_lvl+0x84/0xd0
> [24119.281508] bad_page.cold+0xbe/0xe0
> [24119.281510] ? __pfx_bad_page+0x10/0x10
> [24119.281514] ? page_bad_reason+0x9d/0x1f0
> [24119.281517] free_unref_page+0x838/0x10e0
> [24119.281520] __folio_put+0x1ba/0x2b0
> [24119.281523] ? __pfx___folio_put+0x10/0x10
> [24119.281525] ? __pfx___might_resched+0x10/0x10
> [24119.281528] ? migrate_folio_done+0x1de/0x2b0
> [24119.281531] migrate_pages_batch+0xe73/0x2880
> [24119.281534] ? __pfx_compaction_alloc+0x10/0x10
> [24119.281536] ? __pfx_compaction_free+0x10/0x10
> [24119.281539] ? __pfx_migrate_pages_batch+0x10/0x10
> [24119.281543] ? rcu_is_watching+0x12/0xc0
> [24119.281546] migrate_pages+0x194f/0x22f0
> [24119.281548] ? __pfx_compaction_alloc+0x10/0x10
> [24119.281550] ? __pfx_compaction_free+0x10/0x10
> [24119.281553] ? __pfx_migrate_pages+0x10/0x10
> [24119.281555] ? rcu_is_watching+0x12/0xc0
> [24119.281557] ? isolate_migratepages_block+0x2b02/0x4560
> [24119.281561] ? __pfx_isolate_migratepages_block+0x10/0x10
> [24119.281563] ? folio_putback_lru+0x5e/0xb0
> [24119.281566] compact_zone+0x1a7c/0x3860
> [24119.281569] ? rcu_is_watching+0x12/0xc0
> [24119.281571] ? __pfx___free_object+0x10/0x10
> [24119.281575] ? __pfx_compact_zone+0x10/0x10
> [24119.281577] ? rcu_is_watching+0x12/0xc0
> [24119.281579] ? lock_acquire+0x457/0x540
> [24119.281581] ? kcompactd+0x2fa/0xc70
> [24119.281583] ? rcu_is_watching+0x12/0xc0
> [24119.281585] compact_node+0x144/0x240
> [24119.281588] ? __pfx_compact_node+0x10/0x10
> [24119.281593] ? rcu_is_watching+0x12/0xc0
> [24119.281595] kcompactd+0x686/0xc70
> [24119.281598] ? __pfx_kcompactd+0x10/0x10
> [24119.281600] ? __pfx_autoremove_wake_function+0x10/0x10
> [24119.281603] ? __kthread_parkme+0xb1/0x1d0
> [24119.281605] ? __pfx_kcompactd+0x10/0x10
> [24119.281608] ? __pfx_kcompactd+0x10/0x10
> [24119.281610] kthread+0x2d2/0x3a0
> [24119.281612] ? _raw_spin_unlock_irq+0x28/0x60
> [24119.281614] ? __pfx_kthread+0x10/0x10
> [24119.281616] ret_from_fork+0x31/0x70
> [24119.281618] ? __pfx_kthread+0x10/0x10
> [24119.281620] ret_from_fork_asm+0x1a/0x30
> [24119.281624] </TASK>
> [24171.367867] watchdog: BUG: soft lockup - CPU#25 stuck for 26s!
> [kworker/u130:3:2474335]
>
> I attached the full kernel log below.
>
> [1] https://lore.kernel.org/linux-kernel/CABXGCsPktcHQOvKTbPaTwegMExije=Gpgci5NW=hqORo-s7diA@mail.gmail.com/
Sorry to know that nobody is looking at this for two months.. However I
think we'll need to fix them separately anyway. Let me post a fix for the
known first.
--
Peter Xu
Powered by blists - more mailing lists